What’s Vulnerable › Vulnerabilities

CVE-2025-23210: Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-03 · updated 2026-06-17
• Weakness: CWE-79

Description

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• PHPOffice PhpSpreadsheet: from 3.0.0, < 3.9.0; from 2.2.0, < 2.3.7; from 2.0.0, < 2.1.8; before 1.29.9

References

• https://github.com/PHPOffice/PhpSpreadsheet/commit/cde2926a9e2baf146783f8fd1771bbed7d1dc7b3
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r57h-547h-w24f

Get alerted when CVE-2025-23210 or the next vulnerability affects your stack